---
id: CVE-2025-38209
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvme-tcp: remove tag set when second admin queue config fails

  Commit 104d0e2f6222 ("nvme-fabrics: reset admin connection for secure
  concatenation") modified nvme_tcp_s…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvme-tcp: remove tag set when second admin queue config fails

  Commit 104d0e2f6222 ("nvme-fabrics: reset admin connection for secure
  concatenation") modified nvme_tcp_s…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 6.15, < 6.15.4'
patched:
  - linux_kernel 6.15.4
published: '2025-07-04'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:35.113'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-38209'
references:
  - url: 'https://git.kernel.org/stable/c/db1da838b6012e4570c6f81e28ffe1d0ff595948'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e7143706702a209c814ed2c3fc6486c2a7decf6c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00357
epssPercentile: 0.29657
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-15T21:48:31.130301Z'
ingestedAt: '2026-10-15T22:48:25.498Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: remove tag set when second admin queue config fails

Commit 104d0e2f6222 ("nvme-fabrics: reset admin connection for secure
concatenation") modified nvme_tcp_setup_ctrl() to call
nvme_tcp_configure_admin_queue() twice. The first call prepares for
DH-CHAP negotitation, and the second call is required for secure
concatenation. However, this change triggered BUG KASAN slab-use-after-
free in blk_mq_queue_tag_busy_iter(). This BUG can be recreated by
repeating the blktests test case nvme/063 a few times [1].

When the BUG happens, nvme_tcp_create_ctrl() fails in the call chain
below:

nvme_tcp_create_ctrl()
 nvme_tcp_alloc_ctrl() new=true             ... Alloc nvme_tcp_ctrl and admin_tag_set
 nvme_tcp_setup_ctrl() new=true
  nvme_tcp_configure_admin_queue() new=true ... Succeed
   nvme_alloc_admin_tag_set()               ... Alloc the tag set for admin_tag_set
  nvme_stop_keep_alive()
  nvme_tcp_teardown_admin_queue() remove=false
  nvme_tcp_configure_admin_queue() new=false
   nvme_tcp_alloc_admin_queue()             ... Fail, but do not call nvme_remove_admin_tag_set()
 nvme_uninit_ctrl()
 nvme_put_ctrl()                            ... Free up the nvme_tcp_ctrl and admin_tag_set

The first call of nvme_tcp_configure_admin_queue() succeeds with
new=true argument. The second call fails with new=false argument. This
second call does not call nvme_remove_admin_tag_set() on failure, due to
the new=false argument. Then the admin tag set is not removed. However,
nvme_tcp_create_ctrl() assumes that nvme_tcp_setup_ctrl() would call
nvme_remove_admin_tag_set(). Then it frees up struct nvme_tcp_ctrl which
has admin_tag_set field. Later on, the timeout handler accesses the
admin_tag_set field and causes the BUG KASAN slab-use-after-free.

To not leave the admin tag set, call nvme_remove_admin_tag_set() when
the second nvme_tcp_configure_admin_queue() call fails. Do not return
from nvme_tcp_setup_ctrl() on failure. Instead, jump to "destroy_admin"
go-to label to call nvme_tcp_teardown_admin_queue() which calls
nvme_remove_admin_tag_set().

## Affected

- `linux_kernel >= 6.15, < 6.15.4`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.15.4`